pakstr 0.31.0 → 1.0.0

package/android-template/app/src/main/java/com/pakstr/app/WebMessageRouter.kt

@@ -0,0 +1,186 @@
+package com.pakstr.app
+
+import com.pakstr.app.signer.NostrBridge
+import com.pakstr.app.signer.UnsupportedBridgeMethodException
+import kotlinx.coroutines.CancellationException
+import kotlinx.coroutines.CoroutineScope
+import kotlinx.coroutines.launch
+import org.json.JSONObject
+
+/** Where a bridge message came from (android.net.Uri components plus the frame flag). */
+internal data class MessageSource(
+    val scheme: String?,
+    val host: String?,
+    val port: Int,
+    val userInfo: String?,
+    val path: String?,
+    val isMainFrame: Boolean
+)
+
+internal fun interface BridgeHandler {
+    suspend fun handle(method: String, params: JSONObject?): Any?
+}
+
+/**
+ * Validates and dispatches messages posted to the injected bridge object.
+ *
+ * Fail closed: messages from subframes or other origins, non-string or
+ * oversized data, and malformed envelopes are dropped without a reply.
+ * A request `{ v: 1, id, method, params? }` is answered once, only to the
+ * frame that sent it, with `{ v: 1, id, ok: true, result }` or
+ * `{ v: 1, id, ok: false, error: { error, message } }`. Notifications
+ * (no reply) carry no id.
+ */
+internal class WebMessageRouter(
+    private val handler: BridgeHandler,
+    private val scope: CoroutineScope,
+    private val runOnMain: (() -> Unit) -> Unit,
+    private val log: (String) -> Unit = {}
+) {
+
+    fun onMessage(
+        source: MessageSource,
+        data: String?,
+        reply: (String) -> Unit
+    ) {
+        rejectionReason(source, data)?.let { reason ->
+            log("Bridge message rejected: $reason")
+            return
+        }
+        val message = try {
+            JSONObject(requireNotNull(data))
+        } catch (_: Exception) {
+            log("Bridge message rejected: malformed message")
+            return
+        }
+        if (message.opt("v") != PROTOCOL_VERSION) {
+            log("Bridge message rejected: unsupported protocol version")
+            return
+        }
+
+        val method = message.opt("method") as? String
+        val params = when (val value = message.opt("params")) {
+            null, JSONObject.NULL -> null
+            is JSONObject -> value
+            else -> INVALID_PARAMS
+        }
+
+        if (method in NOTIFICATIONS) {
+            if (params !== INVALID_PARAMS) {
+                scope.launch {
+                    try {
+                        handler.handle(requireNotNull(method), params)
+                    } catch (error: CancellationException) {
+                        throw error
+                    } catch (_: Exception) {
+                        // Notifications have no reply channel.
+                    }
+                }
+            }
+            return
+        }
+
+        val id = message.opt("id") as? String
+        if (id == null || !REQUEST_ID.matches(id)) {
+            log("Bridge message rejected: invalid request id")
+            return
+        }
+        if (method == null || params === INVALID_PARAMS) {
+            val response = failure(id, IllegalArgumentException("Invalid request"))
+            runOnMain { reply(response) }
+            return
+        }
+
+        scope.launch {
+            val response = try {
+                success(id, handler.handle(method, params))
+            } catch (error: CancellationException) {
+                throw error
+            } catch (error: Exception) {
+                failure(id, error)
+            }
+            runOnMain { reply(response) }
+        }
+    }
+
+    private fun rejectionReason(
+        source: MessageSource,
+        data: String?
+    ): String? = when {
+        !source.isMainFrame -> "subframe"
+        !AppOrigin.isTrustedOrigin(
+            source.scheme,
+            source.host,
+            source.port,
+            source.userInfo,
+            source.path
+        ) -> "untrusted origin"
+        data == null -> "non-string message"
+        data.length > MAX_MESSAGE_BYTES ||
+                data.toByteArray(Charsets.UTF_8).size > MAX_MESSAGE_BYTES -> "message too large"
+        else -> null
+    }
+
+    private fun success(id: String, result: Any?): String =
+        envelope(id)
+            .put("ok", true)
+            .put("result", result ?: JSONObject.NULL)
+            .toString()
+
+    private fun failure(id: String, error: Exception): String =
+        envelope(id)
+            .put("ok", false)
+            .put("error", JSONObject(NostrBridge.signerErrorResponse(error)))
+            .toString()
+
+    private fun envelope(id: String): JSONObject =
+        JSONObject()
+            .put("v", PROTOCOL_VERSION)
+            .put("id", id)
+
+    companion object {
+        const val PROTOCOL_VERSION = 1
+
+        /** Same limit as nip07.js, which rejects larger requests before posting them. */
+        const val MAX_MESSAGE_BYTES = 1024 * 1024
+
+        const val DEBUG_LOG_METHOD = "debug.log"
+
+        private val NOTIFICATIONS = setOf(DEBUG_LOG_METHOD)
+        private val REQUEST_ID = Regex("[A-Za-z0-9-]{1,64}")
+        private val INVALID_PARAMS = JSONObject()
+    }
+}
+
+/** Routes `nostr.*`, `runtime.*`, and `debug.log` to their native handlers. */
+internal class PakstrBridgeMethods(
+    private val nostr: NostrBridge,
+    private val runtime: PakstrBridge,
+    private val debugLog: (level: String, message: String) -> Unit
+) : BridgeHandler {
+
+    override suspend fun handle(method: String, params: JSONObject?): Any? =
+        when (method) {
+            "runtime.getApiBaseUrl" -> runtime.getApiBaseUrl()
+            "runtime.setApiBaseUrl" ->
+                (params?.opt("url") as? String)?.let(runtime::setApiBaseUrl) ?: false
+            "runtime.getNip55CallbackUrl" -> runtime.getNip55CallbackUrl()
+            WebMessageRouter.DEBUG_LOG_METHOD -> {
+                debugLog(
+                    params?.opt("level") as? String ?: "LOG",
+                    params?.opt("message") as? String ?: ""
+                )
+                null
+            }
+            else ->
+                if (method.startsWith(NOSTR_PREFIX)) {
+                    nostr.handle(method.removePrefix(NOSTR_PREFIX), params)
+                } else {
+                    throw UnsupportedBridgeMethodException()
+                }
+        }
+
+    private companion object {
+        const val NOSTR_PREFIX = "nostr."
+    }
+}

package/android-template/app/src/main/java/com/pakstr/app/WebViewController.kt

@@ -31,8 +31,7 @@ import kotlinx.coroutines.withContext
  * Responsibilities:
  * - Configure secure WebView settings
  * - Load local web application from NanoHTTPD server
- * - Inject NIP-07 JavaScript provider
- * - Expose Android signer bridge to JavaScript
+ * - Install the origin-checked JavaScript bridge and NIP-07 provider
  * - Handle Web permissions
  * - Cleanup WebView resources
  */
@@ -52,6 +51,7 @@ class WebViewController(
     private var pendingNip55Result: String? = null
     private var isSetup = false
     private val nip55Scope = CoroutineScope(SupervisorJob() + Dispatchers.IO)
+    private val bridgeScope = CoroutineScope(SupervisorJob() + Dispatchers.IO)
 
     // Keeps a reference to the runnable to prevent memory leaks if destroyed early
     private val loadRunnable = Runnable {
@@ -63,8 +63,6 @@ class WebViewController(
         //webView.loadUrl("http://127.0.0.1:$port/not-found.html")
     }
 
-    private var nip07Injected = false
-
     fun setup() {
         showLoader()
         setupCookies()
@@ -121,10 +119,6 @@ class WebViewController(
 
                     hideLoader()
 
-                    if (!nip07Injected) {
-                        nip07Injected = injectNip07()
-
-                    }
                     if (AppDebugLogger.isWebViewLoggingEnabled(context)) {
                         injectDebugLogger()
                     }
@@ -235,7 +229,18 @@ class WebViewController(
                     view: WebView?, request: WebResourceRequest?
                 ): Boolean {
                     val url = request?.url ?: return true
-                    if (url.scheme.equals("nostrsigner", ignoreCase = true)) {
+                    val decision = navigationDecision(
+                        url.scheme,
+                        url.host,
+                        url.port,
+                        url.userInfo,
+                        request.isForMainFrame
+                    )
+                    if (decision == NavigationDecision.REJECT_SUBFRAME_NIP55) {
+                        logNip55Rejection("subframe request")
+                        return true
+                    }
+                    if (decision == NavigationDecision.NIP55_SIGN_REQUEST) {
                         dispatchNip55SignEvent(
                             rawUrl = url.toString(),
                             activeSignerType = signerManager.getActiveType(),
@@ -269,7 +274,7 @@ class WebViewController(
                         )
                         return true
                     }
-                    return url.host != "127.0.0.1"
+                    return decision != NavigationDecision.ALLOW
                 }
 
             }
@@ -323,25 +328,7 @@ class WebViewController(
             }
         }
 
-        // Exposes native Nostr signer APIs to the WebView.
-        // Available in JavaScript as window.AndroidBridge.
-        webView.addJavascriptInterface(
-
-            NostrBridge(
-
-                signerManager = signerManager,
-
-                webView = webView,
-
-                ),
-
-            "AndroidBridge"
-
-        )
-        webView.addJavascriptInterface(
-            PakstrBridge(RuntimeApiBaseSettings.from(context)),
-            "PakstrBridge"
-        )
+        installBridge()
 
     }
 
@@ -406,6 +393,7 @@ class WebViewController(
 
     fun destroy() {
         nip55Scope.cancel()
+        bridgeScope.cancel()
         webView.stopLoading()
 
         webView.clearHistory()
@@ -422,24 +410,48 @@ class WebViewController(
         webView.destroy()
     }
 
-    private fun injectNip07(): Boolean {
-
-        return try {
-            val js = context.assets.open("nip07.js")
+    /**
+     * Exposes window.nostr and window.pakstr to the app origin's top-level
+     * frame only (see PakstrWebBridge). Runs before the first load.
+     */
+    private fun installBridge() {
+        val providerScript = try {
+            context.assets.open("nip07.js")
                 .bufferedReader()
-                .readText()
-
-            webView.evaluateJavascript(
-                js, null
-            )
-            true
+                .use { it.readText() }
         } catch (e: Exception) {
-            if (AppDebugLogger.isWebViewLoggingEnabled(context)) {
-                AppDebugLogger.log(
-                    context, "WebViewController - WEBVIEW", "Failed loading nip07.js: ${e.message}"
-                )
-            }
-            false
+            AppDebugLogger.error(context, "BRIDGE", "Failed loading nip07.js", e)
+            return
+        }
+        val router = WebMessageRouter(
+            handler = PakstrBridgeMethods(
+                nostr = NostrBridge(
+                    signerProvider = signerManager::getConfiguredSigner,
+                    log = { message -> AppDebugLogger.log(context, "SIGNER", message) },
+                    logError = { message, error ->
+                        AppDebugLogger.error(context, "SIGNER", message, error)
+                    }
+                ),
+                runtime = PakstrBridge(RuntimeApiBaseSettings.from(context)),
+                debugLog = ::logWebConsole
+            ),
+            scope = bridgeScope,
+            runOnMain = { block -> webView.post { block() } },
+            log = { message -> AppDebugLogger.log(context, "BRIDGE", message) }
+        )
+        PakstrWebBridge.install(webView, router, providerScript) { message ->
+            AppDebugLogger.error(context, "BRIDGE", message)
+        }
+    }
+
+    private fun logWebConsole(level: String, message: String) {
+        if (!AppDebugLogger.isWebViewLoggingEnabled(context)) {
+            return
+        }
+        when (level.uppercase()) {
+            "ERROR" -> AppDebugLogger.error(context, "WEB-JS", message)
+            "WARN" -> AppDebugLogger.log(context, "WEB-WARN", message)
+            else -> AppDebugLogger.log(context, "WEB", message)
         }
     }
 
@@ -448,7 +460,8 @@ class WebViewController(
         val js = """
         (function(){
 
-            if (!window.AndroidBridge) {
+            const channel = window.__pakstrNative;
+            if (!channel) {
                 return;
             }
 
@@ -475,9 +488,12 @@ class WebViewController(
                         })
                         .join(" ");
 
-                    window.AndroidBridge.debugLog(
-                        level,
-                        message
+                    channel.postMessage(
+                        JSON.stringify({
+                            v: 1,
+                            method: "debug.log",
+                            params: { level, message }
+                        })
                     );
 
                 } catch(e){